CVE-2024-8610 SourceCodester Best House Rental Management System New Tenant Page index.php cross site scripting

A vulnerability classified as problematic has been found in SourceCodester Best House Rental Management System 1.0. Affected is an unknown function of the file /index.php?page=tenants of the component New Tenant Page. The manipulation of the argument Last Name/First Name/Middle Name leads to cros...

undertow: response write hangs in case of Java 17 TLSv1.3 NewSessionTicket

A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent but the client would continue waiting as Undertow does not send the expected 0\r\n termination of the chunked response. This results in uncontrolled resource...

CVE-2024-8042

Rapid7 Insight Platform versions between November 2019 and August 14, 2024 suffer from missing authorization issues whereby an attacker can intercept local requests to set the name and description of a new user group. This could potentially lead to an empty user group being added to the incorrect...

CVE-2024-8042 Rapid7 Insight Platform Unauthorized Empty Group Creation

Rapid7 Insight Platform versions between November 2019 and August 14, 2024 suffer from missing authorization issues whereby an attacker can intercept local requests to set the name and description of a new user group. This could potentially lead to an empty user group being added to the incorrect...

PT-2024-29423 · Undefined · Undefined

CVE-2024-41493 dcfuzzer-realbugs The detailed information of new real bugs found by dcfuzzer. All of the 5 new real bugs have been reported to the developers and assigned new CVEs from CVE-2024-41493 to CVE-2024-4... https://t.co/Bgveu8mK8J...

PT-2024-39131 · Sourcecodester · Sourcecodester Best House Rental Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Best House Rental Management System version 1.0 Description: A problem has been found in the New Tenant Page component of the file /index.php?page=tenants. The manipulation of the Last Name, First Name, and Middle Name argument...

CVE-2024-8292

The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to privilege escalation/account takeover in all versions up to, and including, 16.26.8. This is due to to plugin not properly verifying a user's identity during new order creation. This makes it possible for...

CVE-2024-8292

The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to privilege escalation/account takeover in all versions up to, and including, 16.26.8. This is due to to plugin not properly verifying a user's identity during new order creation. This makes it possible for...

CVE-2024-8292

CVE-2024-8292 affects WP-Recall – Registration, Profile, Commerce & More for WordPress (versions

Exploit for CVE-2024-25503

CVE-2024-25503 Vulnerability type : Cross Site Scripting...

PT-2024-38920 · WordPress · Wp-Recall

Name of the Vulnerable Software and Affected Versions: WP-Recall – Registration, Profile, Commerce & More plugin for WordPress versions up to, and including, 16.26.8 Description: The WP-Recall plugin for WordPress is vulnerable to privilege escalation/account takeover due to improper verification...

New-Ringer-Server 安全漏洞

New-Ringer-Server is the server code for a Ringer messaging application open-sourced by Lif Platforms. A security vulnerability exists in versions of New-Ringer-Server prior to 1.3.1 that stems from loading a message route without checking that the user loading the session is actually a member of...

CVE-2024-33045 Return of Stack Variable Address in Buses

Memory corruption when BTFM client sends new messages over Slimbus to ADSP...

CVE-2024-45527

REDCap 14.7.0 allows HTML injection via the project title of a New Project action. This can lead to resultant logout CSRF via index.php?logout=1, and can also be used to insert a link to an external phishing website...

CVE-2024-45527

REDCap 14.7.0 allows HTML injection via the project title of a New Project action. This can lead to resultant logout CSRF via index.php?logout=1, and can also be used to insert a link to an external phishing website...

PT-2024-31682 · Redcap · Redcap

Name of the Vulnerable Software and Affected Versions: REDCap version 14.7.0 Description: The issue allows HTML injection via the project title of a New Project action. This can lead to resultant logout CSRF via "index.php?logout=1", and can also be used to insert a link to an external phishing...

Android Browser Open in New Tab Cookie Theft

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Android Browser "Open in New Tab" Cookie Theft', 'Description' = %q In Android's stock AOSP Browser application and WebView component, the "open ...

CVE-2024-45264

A cross-site request forgery CSRF vulnerability in the admin panel in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to add a new administrator, leading to escalation of privileges...

Exploit for Unprotected Alternate Channel in Rockwellautomation Allen-Bradley_Stratix_5200_Firmware

CVE-2023-20198 Exploit PoC for CVE-2023-20198 Description...

Key Takeaways From The Take Command Summit: Navigating New SEC Cybersecurity Disclosure Rules

Understanding and complying with the new SEC Cybersecurity Disclosure Rules is a daunting task for many organizations. The Rapid7 Take Command Summit provided an in-depth look at these regulations, offering valuable guidance for cybersecurity professionals. Here are three key takeaways from the...